# TCH: signature malleability in burnToken enables price manipulation

TCH token's burnToken accepted malleable ECDSA signatures, letting attacker reuse signatures to burn tokens and manipulate price for $18K profit.

- Payout: Real-world hack
- Severity: high
- Program: TCH
- Analysis by: DeFiHackLabs
- Disclosed: 2024-05-16
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-05/TCH_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240516-tch
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:source-review vuln:flash-loan vuln:oracle-manipulation vuln:signature-replay

**Target:** TCH token contract on BSC
**Root cause:** burnToken() did not enforce ECDSA signature uniqueness (e.g., low-s), allowing malleated signatures to be reused for the same nonce.
**Steps:**
1. Obtain valid burnToken signatures from regular transactions (e.g., via block explorer).
2. Malleate each signature by flipping the last byte (0x1c→0x01 or 0x1b→0x00).
3. Flash loan 2.5M BUSDT from BUSDT/USDC PancakeSwap V3 pool.
4. Swap BUSDT to TCH on PancakeSwap, then call burnToken with tampered signatures to burn TCH and manipulate price.
5. Swap remaining TCH back to BUSDT and repay flash loan.
**How found:** Likely noticed that burnToken signatures could be malleated due to missing low-s check, allowing reuse of observed signatures.
**Exploitation:** Attacker flash-loaned BUSDT, swapped to TCH, burned TCH using malleated signatures to reduce supply and inflate price, then sold TCH for profit.
**Insight:** When auditing signature-based burn/mint functions, check for ECDSA malleability (lack of low-s enforcement) and nonce reuse; malleated signatures can bypass uniqueness checks.